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DETAILED ACTION 

Response to Amendment 

1 . This Office Action is in response to applicant's communication filed November 

02, 2007 in response to PTO Office Action mailed May 14, 2007. The applicant's 
remarks and amendments to the claims and/or specification were considered with the 
results that follow. 

2. In response to last Office Action, claims 20 and 23 have been amended. No 
claims have been canceled. Claim 30 has been added. As a result, claims 1-30 remain 
pending in this application. 

Response to Arguments 

3. Applicant's arguments with respect to claims 1-30 have been considered but are 
moot in view of the new ground(s) of rejection. 

Information Disclosure Statement 

4. The information disclosure statement filed November 1 3, 2007 fails to comply 
with the provisions of 37 CFR 1 .97, 1 .98 and MPEP § 609 because the reference cited 
is a publication of the present application. It has been placed in the application file, but 
the information referred to therein has not been considered as to the merits. Applicant is 
advised that the date of any re-submission of any item of information contained in this 
information disclosure statement or the submission of any missing element(s) will be the 
date of submission for purposes of determining compliance with the requirements based 
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on the time of filing the statement, including all certification requirements for statements 
under 37 CFR 1 .97(e). See MPEP § 609.05(a). 



Drawings 

5. The drawings are objected to under 37 CFR 1 .83(a). The drawings must show 
every feature of the invention specified in the claims. Therefore, the claimed features of 
claim 23, e.g. data structure with fields and top-level folders etc. must be shown or the 
feature(s) canceled from the claim(s). No new matter should be entered. 

Corrected drawing sheets in compliance with 37 CFR 1.121(d) are required in 
reply to the Office action to avoid abandonment of the application. Any amended 
replacement drawing sheet should include all of the figures appearing on the immediate 
prior version of the sheet, even if only one figure is being amended. The figure or figure 
number of an amended drawing should not be labeled as "amended." If a drawing figure 
is to be canceled, the appropriate figure must be removed from the replacement sheet, 
and where necessary, the remaining figures must be renumbered and appropriate 
changes made to the brief description of the several views of the drawings for 
consistency. Additional replacement sheets may be necessary to show the renumbering 
of the remaining figures. Each drawing sheet submitted after the filing date of an 
application must be labeled in the top margin as either "Replacement Sheet" or "New 
Sheet" pursuant to 37 CFR 1.121(d). If the changes are not accepted by the examiner, 
the applicant will be notified and informed of any required corrective action in the next 
Office action. The objection to the drawings will not be held in abeyance. 
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Claim Rejections - 35 USC § 101 

6. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

7. Claims 23-29 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. 

Claim 23 recite the computer readable medium containing a data structure fields 
and according to MPEP § 2106.01 , data structure is a descriptive material but the 
claimed data structure fails to provide functional interrelationship (see MPEP § 2106.01 : 

"Certain types of descriptive material, such as music, literature, art, photographs, 
and mere arrangements or compilations of facts or data, without any functional 
interrelationship are not a process, machine, manufacture, or composition of matter. 
USPTO personnel should be prudent in applying the foregoing guidance. Nonfunctional 
descriptive material may be claimed in combination with other functional descriptive 
multi-media material on a computer-readable medium to provide the necessary 
functional and structural interrelationship to satisfy the requirements of 35 U.S.C. 101 . 
The presence of the claimed nonfunctional descriptive material is not necessarily 
determinative of nonstatutory subject matter. For example, a computer that recognizes 
a particular grouping or sequence of musical notes read from memory and thereafter 
causes another defined series of notes to be played, requires a functional 
interrelationship among that data and the computing processes performed when 
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utilizing that data. As such, a claim to that computer is statutory subject matter because 
it implements a statutory process". 

Thus claims 23-29 are rejected as non-statutory subject matter. 

Claim Rejections - 35 USC § 103 

8. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

9. Claims 1-8, 13, 14, 16-22 and 30 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Pruthi et al. (US 2002/0105911) and further in view of Leftwich (US 
6,356,256) and Hamilton et al. (US 2004/0064293). 

As per claims 1 and 30, Pruthi teaches a method of analyzing network traffic on a 
network (Pruthi: pars. [001 1] and [0050]), the network traffic having been captured at a 
network monitoring computer during a period of time (Pruthi: pars. [0050] and [0036]), 
the method comprising: 

at a user computer receiving data points corresponding to the captured network 
traffic (Pruthi: pars. [0060], [0082], figs. 10-23. Here it is noted that Pruthi expressly fail 
to teach data points corresponding to the captured network traffic, however as shown in 
figs. 10-23, graphs are plotted to show the network traffic, where it is readily apparent 
that data points must be received corresponding to the network traffic in order to plot the 
statistics of the network data), the data points comprising: 
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for the captured network traffic, start time, end time, total frames and total bytes 
(Pruthi: figs. 10-13, show packets and bytes captured during duration of time period, 
par. [0036] teaches capturing data in successive time periods, pars. [0091] - [01 1 1] 
explains start time, stop time and number of packets (e.g. frames) captured during time 
and number of bits/bytes captured during the same time period). 

Pruthi fails to teach but in analogous art Leftwich teaches at a user computer 
remote from the network monitor receiving data points (Leftwich: figs. 3B, 4, 5A and 5B, 
col. 4, lines 32-60). It would have been obvious to one having ordinary skill in the art at 
the time of the invention to use remote network monitoring as taught by Leftwich in the 
system of Pruthi such that the network monitoring can be performed from any location, 
without being present at network monitoring location and thus provides flexibility to the 
administrator/user. 

Pruthi and Leftwich further teach information about sections of the captured 
network traffic, the information including start time, end time, number of frames in the 
section and number of bytes in the section (Pruthi: pars. [0036] - [0038] teaches 
generating statistics in recursive time periods and par. [01 1 1] teaches displaying the 
information between various start/stop intervals, where it is readily apparent that the 
information displayed is the sections of the entire capture, e.g. time interval 7:18/12:02 
of fig. 10 is narrowed to the 9:00/10:00 in fig .11, where it is readily apparent that time 
period 9:00/10:00 is a section of the time interval 7:18/12:02. Similarly, Leftwich also 
teaches displaying sections of the original period, e.g. see figs. 4, 5A and 5B of 
Leftwich, where fig. 5B is a section of fig. 5A). 
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Pruthi and Leftwich teach storing graphs including data points at the user 
computer (Leftwich: col. 4, lines 50-60), but fails to teach storing histogram. Hamilton 
teaches storing and displaying sections of the histograms (Hamilton: fig. 1, items 141, 
142, 144, 145, 146, 148; fig. 3; par. [0024]). It would have been obvious to one having 
ordinary skill in the art at the time of the invention to store sections of the histogram as 
taught by Hamilton in the system of Pruthi and Letwich to provide/display historical data 
on a standard monitor screen in a relatively easy to understand manner with less 
memory to store such information (Hamilton: par. [001 1]). 

As per claim 2, Pruthi, Leftwich and Hamilton teach presenting a user with a 
graphical user interface representation of the network traffic by graphing byte density 
overtime in a capture histogram by using the histogram (Pruthi: figs. 10-13, par. [0103]; 
Hamilton: figs. 5-8 teach histogram with utilization (e.g. bits/second), where it is obvious 
that bits/second can also be easily converted into the bytes/second). 

As per claim 3, Pruthi, Leftwich and Hamilton teach wherein presenting a user 
with a graphical user interface representation of the network traffic comprises: 

including a zoom window, the zoom window useful for highlighting a segment of 
the capture histogram (Pruthi: pars. [0102], [0111]; Leftwich: col. 5, lines 43-65); and 

representing the segment of the capture histogram in a zoom histogram 
(Leftwich: figs. 5A and 5B, col. 5, lines 43-65; Pruthi: figs. 10 and 1 1). 

As per claims 4 and 30, Pruthi, Leftwich and Hamilton teach the method further 
comprising: including a data selection window useful for highlighting a segment of the 
zoom histogram (Leftwich: figs. 5A and 5B, col. 5, lines 43-65; Pruthi: figs. 10 and 11); 
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storing a first downloaded captured data file that includes sections corresponding 
to the segment of the zoom histogram highlighted by the data selection window and 
displaying data frames corresponding to the highlighted segment of the zoom window. 
Pruthi, Leftwich and Hamilton teach displaying sections of graph/histogram using user 
selected/highlighted section (see claims 1-3 above, see figs. 10 and 1 1 of Pruthi, figs. 4, 
5A and 5B of Leftwich and figs. 1 and 3 of Hamilton, where it is readily apparent that the 
data corresponding to the sections of histogram is downloaded to the user device 
(Leftwich: col. 4, lines 47-60). 

As per claim 5, Pruthi, Leftwich and Hamilton teach storing a second downloaded 
captured data file that includes sections corresponding to a segment of the zoom 
histogram previously highlighted by the data selection window. With respect to this 
limitation it is understood that according to Pruthi, Leftwich and Hamilton user can select 
and move selection window and also enlarge or narrow the size of the selection, 
window and the respective data is stored at user computer (see claim 4), where it is 
readily apparent that the second downloaded captured data is stored at the user. 

As per claim 6, Pruthi, Leftwich and Hamilton expressly fail to teach storing the 
first downloaded captured data file and the histogram together in a folder, however it is 
readily apparent that the data is stored on the storage device and storing data in a 
folder is well known in the art and the Examiner takes official notice of the fact. 
Therefore it would have been obvious to one having ordinary skill in the art at the time 
of the invention to store data and the histogram in a folder for easy management of the 
stored data because folders are used to manage and categorize the data. 
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As per claims 7 and 8, Pruthi, Leftwich and Hamilton teach wherein presenting a 
user with a graphical interface representation of the network traffic comprise applying a 
compression algorithm to at least a portion of the information in the histogram 
(Hamilton: par. [0012]). 

As per claim 13, Pruthi, Leftwich and Hamilton expressly fail to teach 
downloading sections from the network monitoring computer that are not stored in 
downloaded captured data files at the user computer, however Pruthi, Leftwich and 
Hamilton teach a system that analyzes the continuous network data (Pruthi: par. [0036] 
recursively collecting data; Hamilton: par. [0024]), and Leftwich teaches remote analysis 
and display (Leftwich: abstract), where it is readily apparent that the data is displayed in 
continuous manner and therefore the data not stored at user computer is downloaded 
from the monitor computer. 

Pruthi, Leftwich and Hamilton further teach combining the downloaded sections 
with a downloaded captured data file that was previously stored at the user computer 
(Hamilton: pars. [0042] - [0046]). 

As per claims 14 and 16, Pruthi, Leftwich and Hamilton teach saving histogram 
and downloaded data for later use (Pruthi: par. [0034]; Leftwich: col. 4, lines 50-60; 
Hamilton: par. [0045]). 

As per claim 17, Pruthi, Leftwich and Hamilton teach creating an individual 
histogram for the downloaded capture data file stored on the user computer for later use 
and displaying the individual histogram at the user computer (Hamilton: pars. [0042] - 
[0046]). 
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As per claim 18, Pruthi, Leftwich and Hamilton teach a computer readable 
medium with instructions for performing the method of claim 1 (Pruthi: claim 74, 
Hamilton: claim 19). 

Claim 19 is rejected under same rationales as applied to claim 1 . 

Claims 20 and 21 are rejected under same rationales as applied to claim 2. 

Claim 22 is rejected under same rationales as applied to claim 13. 

10. Claims 23-29 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Pruthi et al. (US 2002/010591 1 ) and further in view of Leftwich (US 6.356.256). 
Hamilton et al. (US 2004/0064293) and Finqerhut et al. (US 7.039.577). 

As per claim 23, Pruthi, Leftwich and Hamilton teach storing captured data and 
sections of captured data as well as related histograms and start time, end time, total 
frames, total bytes for entire captured data and sections of captured data (see claim 1 
above), however Pruthi, Leftwich and Hamilton fail to teach data structure with fields 
and storing data into folders. Fingerhut teaches storing histograms in the folders 
(Fingerhut: figs. 4-7) and using databases with various fields (col. 7, lines 31-50). Thus, 
it would have been obvious to one having ordinary skill in the art at the time of the 
invention to store data using fields of data structure as taught by Fingerhut to retrieve 
data more efficiently. 

Claims 24-27 are directed towards giving particular names to the folders and 
location of folders, which can be mere design choice and as taught by Fingerhut, the 
folders are given names like host histograms, as well as the dates on which the data are 
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collected (figs. 4-6) and the histograms are stored at top level folder (e.g. fig. 4), thus it 
can be inferred that giving particular names and storing data at particular fields or 
location or partition is mere matter of design choice and failed to provide any patentable 
subject matter over Pruthi, Leftwich or Hamilton. 

As per claim 28, Fingerhut teaches storing various histogram files (figs. 4-6), 
where it is readily apparent that when the file is opened, the file must create the related 
histogram from the downloaded data. 

As per claim 29, Hamilton teaches at least one of the downloaded captured data 
files being formed from a plurality of downloaded captured data files (fig. 3). 

Allowable Subject Matter 

1 1 . Claims 9-1 2 and 1 5 are objected to as being dependent upon a rejected base 
claim, but would be allowable if rewritten in independent form including all of the 
limitations of the base claim and any intervening claims. 

Conclusion 

12. The examiner also requests, in response to this Office action, support be shown 
for language added to any original claims on amendment and any new claims. That is, 
indicate support for newly added claim language by specifically pointing to page(s) and 
line no(s) in the specification and/or drawing figure(s). This will assist the examiner in 
prosecuting the application. 
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When responding to this office action, Applicant is advised to clearly point out the 
patentable novelty which he or she thinks the claims present, in view of the state of the 
art disclosed by the references cited or the objections made. He or she must also show 
how the amendments avoid such references or objections See 37 CFR 1.111 (c). 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Kaushikkumar Patel whose telephone number is 
(571)272-5536. The examiner can normally be reached on 7.30 am - 4.00 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Hyung Sough can be reached on 571-272-6799. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Hyung S. Sough/ Kaushikkumar Patel 

Supervisory Patent Examiner, Art Unit 21 88 Examiner 
03/16/09 Art Unit 2188 
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